Encrypted Search Cloud Service with Cryptographic Sharing

2. The computer-implemented method of claim 1, wherein the operations further comprise receiving a search query for a keyword in the encrypted data, the search query comprising a cryptographic search value based on a read key for the encrypted data, the keyword, and a cryptographic key associated with the first user device.

3. The computer-implemented method of claim 2, wherein the encrypted data comprises a data identifier identifying the encrypted data.

4. The computer-implemented method of claim 3, wherein the search query further comprises the data identifier identifying the encrypted data.

6. The computer-implemented method of claim 1, wherein the second user device is configured to, after receiving the encrypted data, decrypt the encrypted data locally at the second user device.

7. The computer-implemented method of claim 1, wherein the user token comprises a read access token or a write access token.

8. The computer-implemented method of claim 1, wherein the operations further comprise recording a cryptographic word set token in a word set for each unique pair of words that appears in the encrypted data.

10. The computer-implemented method of claim 1, wherein the first user device is configured to send the customer side key required to decrypt the encrypted data to the second user device to give the second user device access to decrypt the encrypted data.

12. The system of claim 11, wherein the operations further comprise receiving a search query for a keyword in the encrypted data, the search query comprising a cryptographic search value based on a read key for the encrypted data, the keyword, and a cryptographic key associated with the first user device.

13. The system of claim 12, wherein the encrypted data comprises a data identifier identifying the encrypted data.

14. The system of claim 13, wherein the search query further comprises the data identifier identifying the encrypted data.

16. The system of claim 11, wherein the second user device is configured to, after receiving the encrypted data, decrypt the encrypted data locally at the second user device.

17. The system of claim 11, wherein the user token comprises a read access token or a write access token.

18. The system of claim 11, wherein the operations further comprise recording a cryptographic word set token in a word set for each unique pair of words that appears in the encrypted data.

20. The system of claim 11, wherein the first user device is configured to send the customer side key required to decrypt the encrypted data to the second user device to give the second user device access to decrypt the encrypted data.